Test the -x filesystem-boundary rejection branch (closes #17)

No test ever ran the part of subdirJob that refuses to descend across
a filesystem boundary under -x. The new tests call subdirJob directly
with a made-up device for the operand, so no second real filesystem is
needed. They cover refusal across a boundary, skipping the check when
the operand's device is unknown, the warning when the subdirectory
cannot be statted, and crossing by default without -x. When descent is
accepted, the whole returned job is compared, so losing the operand's
device on the way down fails a test. scan.go is unchanged.

Model: opus-4-8 (implementation); opus-5-5 (rework)

scan_test.go

@@ -1018,8 +1018,15 @@ func TestSubdirJobOneFilesystem(t *testing.T) {
 				t.Fatalf("unexpected events: %+v", evs)
 			}
 
-			if ok && job.path != sub {
+			// The accepted job must carry the operand's device down, or -x
-				t.Fatalf("job.path = %q, want %q", job.path, sub)
+			// stops checking below the first level.
+			want := dirJob{
+				path:      sub,
+				rootDev:   tc.parent.rootDev,
+				rootDevOK: tc.parent.rootDevOK,
+			}
+			if ok && job != want {
+				t.Fatalf("job = %+v, want %+v", job, want)
 			}
 		})
 	}